Missing Authorization in Gitea - CVE-2026-104632
Published: October 19, 2026
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code in a self-hosted Actions runner environment without workflow approval.
The vulnerability exists due to missing authorization checks in Gitea's Actions rerun handling in services/actions/rerun.go when recreating jobs for cancelled workflow runs that still require approval. A remote user can submit a fork pull request containing an attacker-controlled workflow and have an Actions writer cancel and rerun the blocked run to execute arbitrary code in the runner environment, because validateRerun accepts the cancelled run and execRerunPlan creates waiting jobs without checking NeedApproval.
The bypass concerns workflow dispatch, not the fork secrets policy.